Skip to content

Commit 04e47a1

Browse files
phzietsmanphzietsman
authored
Runtime variable (#18)
* Lambda runtime variable * Default to python3.8 to allow Terraform Cloud deployments
1 parent 079dcaa commit 04e47a1

File tree

3 files changed

+67
-22
lines changed

3 files changed

+67
-22
lines changed

‎README.md‎

Lines changed: 51 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -2,35 +2,67 @@
22

33
Get notified when users are taking actions in the AWS Console. More [here](https://medium.com/cloudandthings/aws-clickoops-1b8cabc9b8e3)
44
## 🏗️ Module Usage
5-
### Requirements
65

76
It is not strictly a requirement, that you use this with AWS ControlTower. The module has only been tested in the Log Archive account that ships with AWS ControTower.
87

9-
### Providers
8+
## Requirements
109

1110
| Name | Version |
1211
|------|---------|
13-
| aws | n/a |
14-
| archive | n/a |
12+
| <a name="requirement_terraform"></a> [terraform](#requirement\_terraform) | >= 0.13.1 |
13+
| <a name="requirement_aws"></a> [aws](#requirement\_aws) | >= 4.9 |
1514

16-
### Inputs
15+
## Providers
16+
17+
| Name | Version |
18+
|------|---------|
19+
| <a name="provider_aws"></a> [aws](#provider\_aws) | >= 4.9 |
20+
21+
## Modules
22+
23+
| Name | Source | Version |
24+
|------|--------|---------|
25+
| <a name="module_clickops_notifier_lambda"></a> [clickops\_notifier\_lambda](#module\_clickops\_notifier\_lambda) | git::https://github.com/terraform-aws-modules/terraform-aws-lambda.git | v3.2.1 |
26+
27+
## Resources
28+
29+
| Name | Type |
30+
|------|------|
31+
| [aws_s3_bucket_notification.bucket_notification](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/s3_bucket_notification) | resource |
32+
| [aws_sqs_queue.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue) | resource |
33+
| [aws_sqs_queue_policy.bucket_notifications](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/sqs_queue_policy) | resource |
34+
| [aws_ssm_parameter.slack_webhook](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/ssm_parameter) | resource |
35+
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
36+
| [aws_iam_policy_document.lambda_permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
37+
| [aws_s3_bucket.cloudtrail_bucket](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/s3_bucket) | data source |
38+
39+
## Inputs
1740

1841
| Name | Description | Type | Default | Required |
1942
|------|-------------|------|---------|:--------:|
20-
| cloudtrail\_bucket\_name | Bucket containing the Cloudtrail logs that you want to process. ControlTower bucket name follows this naming convention `aws-controltower-logs-{{account_id}}-{{region}}` | `string` | n/a | yes |
21-
| webhook | The webhook URL for notifications. https://api.slack.com/messaging/webhooks | `string` | n/a | yes |
22-
| region | Region where this will be deployed. Used for [getting the correct lambda layer] | `string` | n/a | yes |
23-
| message\_format | Where do you want to send this message? Only slack, for now. | `string` | `"slack"` | no |
24-
| excluded\_accounts | List of accounts that be excluded for scans on manual actions. These take precidence over `included_accounts` | `list(string)` | `[]` | no |
25-
| included\_accounts | List of accounts that be scanned to manual actions. If empty will scan all accounts. | `list(string)` | `[]` | no |
26-
| excluded\_users | List of email addresses will not be reported on when practicing ClickOps. | `list(string)` | `[]` | no |
27-
| included\_users | List of emails that be scanned to manual actions. If empty will scan all emails. | `list(string)` | `[]` | no |
28-
| naming\_prefix | Resources will be prefixed with this | `string` | `"clickops-notifier"` | no |
29-
| tags | Tags to add to resources in addition to the default\_tags for the provider | `map(string)` | `{}` | no |
30-
| event\_processing\_timeout | Maximum number of seconds the lambda is allowed to run and number of seconds events should be hidden in SQS after being picked up my Lambda. | `number` | `60` | no |
31-
| event\_batch\_size | Batch events into chunks of `event_batch_size` | `number` | `10` | no |
32-
| event\_maximum\_batching\_window | Maximum batching window in seconds. | `number` | `300` | no |
33-
| log\_retention\_in\_days | Number of days to keep CloudWatch logs | `number` | `14` | no |
43+
| <a name="input_additional_iam_policy_statements"></a> [additional\_iam\_policy\_statements](#input\_additional\_iam\_policy\_statements) | Map of dynamic policy statements to attach to Lambda Function role | `any` | `{}` | no |
44+
| <a name="input_cloudtrail_bucket_name"></a> [cloudtrail\_bucket\_name](#input\_cloudtrail\_bucket\_name) | Bucket containing the Cloudtrail logs that you want to process. ControlTower bucket name follows this naming convention `aws-controltower-logs-{{account_id}}-{{region}}` | `string` | n/a | yes |
45+
| <a name="input_event_batch_size"></a> [event\_batch\_size](#input\_event\_batch\_size) | Batch events into chunks of `event_batch_size` | `number` | `10` | no |
46+
| <a name="input_event_maximum_batching_window"></a> [event\_maximum\_batching\_window](#input\_event\_maximum\_batching\_window) | Maximum batching window in seconds. | `number` | `300` | no |
47+
| <a name="input_event_processing_timeout"></a> [event\_processing\_timeout](#input\_event\_processing\_timeout) | Maximum number of seconds the lambda is allowed to run and number of seconds events should be hidden in SQS after being picked up my Lambda. | `number` | `60` | no |
48+
| <a name="input_excluded_accounts"></a> [excluded\_accounts](#input\_excluded\_accounts) | List of accounts that be excluded for scans on manual actions. These take precidence over `included_accounts` | `list(string)` | `[]` | no |
49+
| <a name="input_excluded_users"></a> [excluded\_users](#input\_excluded\_users) | List of email addresses will not be reported on when practicing ClickOps. | `list(string)` | `[]` | no |
50+
| <a name="input_included_accounts"></a> [included\_accounts](#input\_included\_accounts) | List of accounts that be scanned to manual actions. If empty will scan all accounts. | `list(string)` | `[]` | no |
51+
| <a name="input_included_users"></a> [included\_users](#input\_included\_users) | List of emails that be scanned to manual actions. If empty will scan all emails. | `list(string)` | `[]` | no |
52+
| <a name="input_lambda_runtime"></a> [lambda\_runtime](#input\_lambda\_runtime) | The lambda runtime to use | `string` | `"python3.9"` | no |
53+
| <a name="input_log_retention_in_days"></a> [log\_retention\_in\_days](#input\_log\_retention\_in\_days) | Number of days to keep CloudWatch logs | `number` | `14` | no |
54+
| <a name="input_message_format"></a> [message\_format](#input\_message\_format) | Where do you want to send this message? Only slack, for now. | `string` | `"slack"` | no |
55+
| <a name="input_naming_prefix"></a> [naming\_prefix](#input\_naming\_prefix) | Resources will be prefixed with this | `string` | `"clickops-notifier"` | no |
56+
| <a name="input_tags"></a> [tags](#input\_tags) | Tags to add to resources in addition to the default\_tags for the provider | `map(string)` | `{}` | no |
57+
| <a name="input_webhook"></a> [webhook](#input\_webhook) | The webhook URL for notifications. https://api.slack.com/messaging/webhooks | `string` | n/a | yes |
58+
59+
## Outputs
60+
61+
| Name | Description |
62+
|------|-------------|
63+
| <a name="output_clickops_notifier_lambda"></a> [clickops\_notifier\_lambda](#output\_clickops\_notifier\_lambda) | n/a |
64+
| <a name="output_sqs_queue"></a> [sqs\_queue](#output\_sqs\_queue) | n/a |
65+
3466

3567
----
3668
## 🚙 Test Drive
@@ -45,8 +77,6 @@ terraform plan -out=plan
4577
# var.cloudtrail_bucket_name
4678
# Enter a value: aws-controltower-logs-123456789012-eu-west-1
4779

48-
# var.region
49-
# Enter a value: eu-west-1
5080

5181
# var.webhook
5282
# Enter a value: https://hooks.slack.com/services/xxx/xxx/xxx

‎lambda.tf‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ module "clickops_notifier_lambda" {
66
description = "ClickOps Notifier Lambda"
77

88
handler = "main.handler"
9-
runtime = "python3.9"
9+
runtime = var.lambda_runtime
1010
publish = true
1111
source_path = "${path.module}/lambda/app"
1212

‎variables.tf‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -93,3 +93,18 @@ variable "log_retention_in_days" {
9393
default = 14
9494
}
9595

96+
variable "lambda_runtime" {
97+
type = string
98+
description = "The lambda runtime to use"
99+
default = "python3.8"
100+
101+
validation {
102+
condition = contains([
103+
"python3.9",
104+
"python3.8",
105+
"python3.7",
106+
"python3.6"
107+
], var.lambda_runtime)
108+
error_message = "Invalid lambda_runtime provided."
109+
}
110+
}

0 commit comments

Comments
 (0)